picard3
LOW
maintainer SamWhited
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The source is a tarball from the official project's infrastructure (data.musicbrainz.org), which is plausibly legitimate; building from project-owned host is normal for AUR, even if not on a whitelist.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official project's infrastructure (data.musicbrainz.org), which is plausibly legitimate; building from project-owned host is normal for AUR, even if not on a whitelist.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:47
source=("http://data.musicbrainz.org/pub/musicbrainz/${_pkgname}/${_pkgname}-${pkgver}.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Sam Whited <sam@samwhited.com>
2
# Contributor: David Runge <dvzrv@archlinux.org>
3
# Contributor: Gaetan Bisson <bisson@archlinux.org>
4
# Contributor: Mateusz Herych <heniekk@gmail.com>
5
# Contributor: sysrq
6
7
_pkgname=picard
8
pkgname="${_pkgname}3"
9
pkgver=3.0.1
10
pkgrel=1
11
epoch=1
12
pkgdesc="Official MusicBrainz tagger"
13
arch=(x86_64)
14
url="https://github.com/metabrainz/picard"
15
license=(GPL-2.0-or-later)
16
provides=(picard)
17
conflicts=(picard)
18
depends=(
19
glibc
20
hicolor-icon-theme
21
python
22
python-cffi
23
python-charset-normalizer
24
python-dateutil
25
python-discid
26
python-fasteners
27
python-markdown
28
python-mutagen
29
python-pyjwt
30
python-pyqt6
31
python-tomlkit
32
python-yaml
33
)
34
makedepends=(
35
python-build
36
python-installer
37
python-setuptools
38
python-wheel
39
)
40
checkdepends=(python-pytest)
41
optdepends=(
42
'chromaprint: fingerprinting'
43
'python-pygit2: plugin installation'
44
'qt6-multimedia: media player toolbar'
45
'qt6-translations: full UI translation'
46
)
47
source=("http://data.musicbrainz.org/pub/musicbrainz/${_pkgname}/${_pkgname}-${pkgver}.tar.gz")
48
sha256sums=('a18fea920b3a76d337460f25a7b27673742f8c482306e63b884d9cfba524b338')
49
50
build() {
51
cd $_pkgname-$pkgver
52
PICARD_DISABLE_AUTOUPDATE=1 python -m build --wheel --no-isolation
53
}
54
55
package() {
56
cd $_pkgname-$pkgver
57
python -m installer --destdir="$pkgdir" dist/*.whl
58
install -vDm 644 {AUTHORS.txt,{CONTRIBUTING,NEWS,README}.md} -t "$pkgdir/usr/share/doc/$pkgname/"
59
}
60
61
# vim:set ts=2 sw=2 et:
62
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |